Russian government hackers broke into thousands of home routers to steal passwords

Fancy Bear (APT28) hijacked thousands of unpatched MikroTik and TP-Link home and small-business routers worldwide to silently redirect internet traffic to attacker-controlled infrastructure, allowing the actors to serve spoofed sites and steal passwords and access tokens (bypassing two-factor authentication). Black Lotus Labs reported at least 18,000 compromised victims across roughly 120 countries, while Microsoft identified over 200 organizations and 5,000 consumer devices affected; a coalition including the FBI and Lumen disrupted the botnet and took several domains offline.